Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'oPS1bZhYWWNdjjQjyOm2vUQ=' = '"%APPDATA%\Roaming\Microsoft\Internet Explorer\wimserv.exe"'
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "oPS1bZhYWWNdjjQjyOm2vUQ=" /d "\"%APPDATA%\Roaming\Microsoft\Internet Explorer\wimserv.exe"\"
- '<SYSTEM32>\PING.EXE' 0 -n 3
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\Dwm.exe
- %WINDIR%\Explorer.EXE
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
- %APPDATA%\Roaming\Microsoft\Network\7C40.tmp.bat
- %APPDATA%\Roaming\Microsoft\Internet Explorer\wimserv.exe
- 'ed#l.cc':443
- 'st#d.cc':443
- 'am#i.cc':443
- DNS ASK dn#.##ftncsi.com
- DNS ASK ed#l.cc
- DNS ASK st#d.cc
- DNS ASK am#i.cc
- '8.#.8.8':63071
- '8.#.8.8':52355
- '8.#.8.8':54755
- '8.#.8.8':56726
- '8.#.8.8':61624
- '8.#.8.8':60745
- '8.#.8.8':53680
- '8.#.8.8':61253
- '8.#.8.8':63718
- '8.#.8.8':53695
- '8.#.8.8':55622
- '8.#.8.8':59304
- '8.#.8.8':62562
- '8.#.8.8':64660
- '8.#.8.8':49239
- '8.#.8.8':62334
- ClassName: 'Indicator' WindowName: '(null)'